25 recommendations. Filter by category, criticality, maturity tier, or system.
The shortlist of Windows security events that actually indicate attacks — logons, privilege use, account changes, and log tampering — and how to collect them.
Default Windows auditing misses the events that matter — deploy Microsoft's recommended Advanced Audit Policy via GPO so logons, privilege use, and account changes are actually recorded.
Directly exposed RDP is the top ransomware entry vector — find every instance, close it now, and move remote access behind VPN/ZTNA, a gateway, or Bastion.
Automatically randomize and rotate the local administrator password on every machine, ending the single-shared-password problem that enables domain-wide lateral movement.
Deploy the three DNS-based email authentication standards in the right order and move DMARC from monitoring to full reject policy safely.
Disable password and root login, enforce key-based authentication, and add brute-force protection to lock down the most attacked service on any Linux server.
Optional analytics cookies help us improve Hardenly. They stay off unless you accept. Cookie policy